1

In troubleshooting an unrelated problem, I noticed that one user's (Jeny) Windows security log showed several logins and logoffs from another user (Holly). Holly confirms that she logged into her computer at the times logged, but she logged into her own computer and not Jeny's. Why is Jeny's computer showing Holly as logging in? I notice the same behavior on my computer. Other users login to their systems and occasionally show as having logged into my system at that time.

The DHCP address leases all match up where they should. I don't see duplicates.

Our server is a Hyper V installation of Windows Server 2012 R2. The workstations all all running Windows 7.

An account was successfully logged on. 
Subject: Security ID: S-1-0-0 
Account Name: - 
Account Domain: - 
Logon ID: 0x0 
Logon Type: 3 
New Logon: 
Security ID: S-1-5-21-3743009763-1566206104-2950842850-1382 
Account Name: Holly 
Account Domain: KDCO 
Logon ID: 0xb49b847 
Logon GUID: {C7A08844-87F2-72D8-1935-6CC6F9CD2FA7} 
Process Information: 
Process ID: 0x0 
Process Name: - 
Network Information: Workstation 
Name: 
Source Network Address: 10.249.144.30 Source Port: 61768
4
  • Do you host shared resources they may be accessing (file shares, printer shares, etc.)? The login audit event should tell you how they logged in (local, network, etc.). Can you post the event contents, so we can see it? – Ƭᴇcʜιᴇ007 Mar 16 '15 at 20:20
  • An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-21-3743009763-1566206104-2950842850-1382 Account Name: Holly Account Domain: KDCO Logon ID: 0xb49b847 Logon GUID: {C7A08844-87F2-72D8-1935-6CC6F9CD2FA7} Process Information: Process ID: 0x0 Process Name: - Network Information: Workstation Name: Source Network Address: 10.249.144.30 Source Port: 61768 – Theresa Mar 16 '15 at 20:34
  • Detailed Authentication Information: Logon Process: Kerberos Authentication Package: Kerberos Transited Services: - Package Name (NTLM only): - Key Length: 0 – Theresa Mar 16 '15 at 20:34
  • We do have a shared folder on our workstations and I am hosting a shared printer. Could that be the cause? – Theresa Mar 16 '15 at 20:39
1

We do have a shared folder on our workstations and I am hosting a shared printer. Could that be the cause?

Looking at the Logon Type in the event you provided, it's #3...

Logon Type 3 – Network

Windows logs logon type 3 in most cases when you access a computer from elsewhere on the network. One of the most common sources of logon events with logon type 3 is connections to shared folders or printers. But other over-the-network logons are classed as logon type 3 as well such as most logons to IIS. (The exception is basic authentication which is explained in Logon Type 8 below.)

Source

2
  • Okay, so sounds like this is normal and nothing for me to worry about. They are not actively trying to access shared resources. But I'm guessing this is just a sort of handshake of resources. Thank you! – Theresa Mar 16 '15 at 20:48
  • If they mapped drives with the "reconnect at logon" option checked, and/or have printers mapped, then each time they log in Windows will reconnect to those resources to ensure they are available and mapped properly. :) – Ƭᴇcʜιᴇ007 Mar 16 '15 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.